Archive
Highlighted

## Find the numerical outliers of the count for countries by day

Explorer

I have the following which gives me the count of events that happen on separate days for each country.
Column1: Date, Column2: Country and Column3: Count

``````index="sample" sourcetype ="access_combined_wcookie" clientip=* | iplocation clientip | convert timeformat="%Y-%m-%d" ctime(_time) AS date | stats count by date, Country
``````

For each Country, there are many days that occur that have events occurring on that day in total count.
I want to find the dates that have an abnormally high amount of events for each country and these would be the outliers.

How can I update my code to obtain this result?

Tags (3)
1 Solution
Highlighted

## Re: Find the numerical outliers of the count for countries by day

Champion

The final solution will depend on how you want to define an outlier. One option would be to identify dates where the count of events was greater than 2 standard deviations above the average count for that country:

``````index="sample" sourcetype ="access_combined_wcookie" clientip=*
| iplocation clientip
| convert timeformat="%Y-%m-%d" ctime(_time) AS date
| stats count by date, Country
| eventstats avg(count) as avg_count stdev(count) as stdev_count BY Country
| where count>(avg_count+(2*stdev_count))
``````
Highlighted

## Re: Find the numerical outliers of the count for countries by day

Path Finder

Hi, I came across same kind of problem. I used this solution as reference. However, When I executed above search everything is working fine but stdev(count) is not working. It is only working when i remove BY country from the search. How can i find Standard deviation for every country?

Thanks,
Chandana

Highlighted

## Re: Find the numerical outliers of the count for countries by day

Explorer

This is great thank you for your response.

Can this action also be performed using the Machine Learning Toolkit for Numerical Outliers?
Would the field to analyze be Count? And fields to split by Date and Country ?